# Connectors

Connect third-party apps so Droid can use their tools in sessions, with managed authentication and organization-level controls.

Connectors give Droid managed access to third-party apps such as GitHub, Linear, Notion, Slack, Sentry, and Google Workspace. Connect an app once, then ask Droid to work with it in natural language. Droid discovers the relevant tools and calls them under your current [Autonomy Level](/autonomy-and-safety/auto-run).

Use Connectors when the app appears in Factory's catalog and you want guided authentication with no server configuration. Use [MCP](/harness/mcp) when you need a custom tool, a self-hosted service, or direct control over the server and transport.

## Connect an app

<Tabs>
  <Tab title="Factory App">
    <Steps>
      <Step title="Open Connectors">
        Open **Settings → Connectors** in the Factory App.
      </Step>
      <Step title="Choose an app">
        Search the catalog or browse the featured and full integration lists. If your organization manages connector availability, only apps an Owner or Manager enabled appear.
      </Step>
      <Step title="Authorize access">
        Select **Connect**. Factory opens the app's authorization flow in a new browser tab. Sign in and approve the access requested by the app.
      </Step>
      <Step title="Delegate work">
        Return to your session and ask Droid to use the app. Droid discovers the connected tools when the task needs them.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Droid session">
    In an interactive session, ask Droid to connect an app:

    ```text
    Connect my Linear account so you can update the issue for this branch.
    ```

    Droid returns an authorization link when the app is available. Open the link, finish the provider's authorization flow, then tell Droid to continue.

    <Note>
      Chat-based connection requires an interactive session because you must open an authorization link. Connect the app in the Factory App before running a non-interactive `droid exec` workflow.
    </Note>
  </Tab>
</Tabs>

Connections belong to both your Factory user and the active organization. If you belong to more than one organization, connect the app separately in each organization where Droid needs access.

## Use a connected app

Ask for the outcome. You do not need to know tool names or API schemas.

```text
Summarize the open Linear issues assigned to me, then update the one for this branch with the implementation status.
```

```text
Read the latest Sentry errors for checkout, correlate them with this code, and propose a fix.
```

```text
Create a Notion page with the rollout plan from this repository and include links to the relevant GitHub pull requests.
```

Droid keeps connector tools in the deferred tool catalog. It loads the matching tool definitions only when a task needs them, which keeps unrelated app schemas out of the session context. Connected tools can also become available during a running session.

Connector calls follow the same approval model as other external tools:

| Tool classification | Default behavior |
| :------------------ | :--------------- |
| Read-only | Classified as low risk. It runs automatically when the session's Autonomy Level allows low-risk actions. |
| Write, destructive, or unknown | Classified as high risk. Droid asks for confirmation unless the session's Autonomy Level allows high-risk actions. |

Connector approvals apply to the current action. They are not stored as [persistent MCP permissions](/harness/mcp#persistent-tool-permissions).

## How connectors work

```mermaid
%%{init: {
  "theme": "base",
  "themeVariables": {
    "fontFamily": "Geist Mono, monospace",
    "fontSize": "14px",
    "primaryColor": "#161413",
    "primaryBorderColor": "#342F2D",
    "primaryTextColor": "#FAFAFA",
    "secondaryColor": "#101010",
    "secondaryBorderColor": "#4D4947",
    "secondaryTextColor": "#D6D3D2",
    "tertiaryColor": "#020202",
    "tertiaryBorderColor": "#342F2D",
    "tertiaryTextColor": "#8A8380",
    "lineColor": "#4D4947",
    "textColor": "#D6D3D2",
    "mainBkg": "#161413",
    "nodeBorder": "#342F2D",
    "edgeLabelBackground": "#020202",
    "clusterBkg": "#0C0A0A",
    "clusterBorder": "#342F2D",
    "activationBkgColor": "#EE6018",
    "activationBorderColor": "#EE6018"
  }
}}%%
flowchart LR
    U[Engineer]
    O[App authorization]
    C[Factory connector service]
    D[Droid]
    A[Third-party app]

    U -->|Connect for this organization| O
    O -->|Authorize| C
    D -->|Call an approved tool| C
    C -->|API request| A
    A -->|Tool result| C
    C -->|Result| D
```

The connection and execution paths stay separate:

| Stage | What happens |
| :---- | :----------- |
| Availability | Factory maintains a curated connector catalog. Enterprise organizations can choose which catalog entries their members may use. |
| Connection | You finish the app's authorization flow. The resulting connection is scoped to your Factory user and active organization. |
| Discovery | Droid retrieves tools for apps you connected and adds them to its deferred tool catalog. |
| Execution | Droid sends approved tool calls through Factory's managed connector service. No connector process runs on your local machine. |
| Disconnection | Factory removes your credential for that app in the active organization. Organization availability for other members does not change. |

If an MCP server and a connected app expose the same capability, Droid removes overlapping tools from the session catalog where possible. Self-hosted and cloud instances remain separate when they may point to different systems.

## Connectors and MCP

Connectors and MCP both extend Droid with external tools. They solve different setup and governance needs.

| | Connectors | MCP |
| :-- | :--------- | :-- |
| Setup | Choose an app and finish its authorization flow. | Configure or install an MCP server. |
| Catalog | Factory-curated third-party apps and tool sets. | Any compatible local or remote MCP server. |
| Runtime | Factory-managed remote connector service. | Local `stdio` process or remote `http` / `sse` endpoint. |
| Authentication | Guided per-user, per-organization connection. | App-provided authorization, headers, environment variables, or server-defined authentication. |
| Configuration | No repository file or server lifecycle to manage. | User, folder, project, or organization `mcp.json`. |
| Organization controls | Owners and Managers enable or disable each catalog app for the organization. | Administrators control server access with managed MCP policy. |
| Best fit | Supported cloud apps that should work with minimal setup. | Custom tools, private services, self-hosted instances, and explicit server control. |

You can use both in the same session. Choose the surface that represents the system you intend to access. For example, keep a self-hosted GitLab MCP server even if you also connect a cloud GitLab account.

## Manage your connections

Open **Settings → Connectors** to review connected apps.

- **Connect** starts a new authorization flow for that app.
- **Disconnect** removes your connection for the active organization. It does not disable the connector for teammates.
- **Suggest a connector** sends Factory the app name, website, and optional use case for review when the app is not in the catalog.

<Warning>
  Never put passwords, API keys, access tokens, or customer data in a connector suggestion. Use the app's authorization flow for credentials.
</Warning>

## Enterprise controls

Enterprise organizations get an organization-specific connector catalog. Connectors start disabled when the organization first configures this control. An **Owner** or **Manager** chooses which apps members can connect and use.

<Steps>
  <Step title="Open Enterprise Controls">
    In the Factory App, open **Settings → Enterprise Controls → Connectors**.
  </Step>
  <Step title="Review the catalog">
    The table shows every connector in Factory's curated catalog and whether it is available to this organization.
  </Step>
  <Step title="Set availability">
    Turn on the apps the organization approves. Turn off an app to remove it from member settings and the tools available to Droid.
  </Step>
  <Step title="Have members connect">
    Availability does not share an account or credential. Each member connects the enabled app with their own identity in **Settings → Connectors**.
  </Step>
</Steps>

The server enforces connector availability. Disabling an app:

- removes it from the organization's Connectors page;
- blocks new authorization links;
- removes its tools from the catalog available to Droid; and
- rejects direct tool calls, including calls from an existing session.

Disabling an app does not delete each member's saved connection. If an Owner or Manager enables it again, a member may still be connected. Members can use **Disconnect** to remove their own credential.

Organizations without Enterprise connector controls use Factory's curated catalog and do not see organization-level availability switches.

## Security and data handling

| Control | Behavior |
| :------ | :------- |
| Identity scope | A connection is isolated by Factory user and active organization. It is not a shared organization credential. |
| App permissions | The third-party app controls the permissions shown during authorization. Review them before approving access. |
| Tool approval | Autonomy and confirmation checks run before Droid calls a connector tool. Unknown or non-read-only tools default to high risk. |
| Server-side enforcement | Organization availability is checked before Factory creates an authorization link or runs a tool. A disabled app cannot be called by bypassing the UI. |
| Local environment | Connector calls run through the managed remote service. They do not start a local process or read local files unless a separate Droid tool supplies that data. |
| Connector audit event | Factory records the connector tool name for the connector invocation event, without adding tool arguments or result content to that event. |

Only connect accounts and workspaces that Droid is allowed to access. The permissions granted by the third-party app remain the final boundary on what its tools can read or change.

## Troubleshooting

<Troubleshooting>
  <TroubleshootingItem title="An app is missing from the catalog">
    Confirm that you selected the intended organization. In an Enterprise organization, ask an Owner or Manager to open **Enterprise Controls → Connectors** and enable the app. If Factory does not offer it, use **Suggest a connector** or configure an [MCP server](/harness/mcp).
  </TroubleshootingItem>

  <TroubleshootingItem title="The authorization page does not open">
    Allow pop-ups for the Factory App, then select **Connect** again to create a fresh link. Confirm that your account can authorize third-party access in the target app.
  </TroubleshootingItem>

  <TroubleshootingItem title="Droid does not see newly connected tools">
    Return to the session and ask Droid to retry. If the active session still has the earlier tool catalog, start a new session. Confirm that the session and connection use the same active organization.
  </TroubleshootingItem>

  <TroubleshootingItem title="A connector tool asks for confirmation">
    Connector tools follow the session's Autonomy Level. Read-only tools are low risk; write, destructive, and unclassified tools are high risk. Connector approvals do not persist as MCP tool permissions.
  </TroubleshootingItem>

  <TroubleshootingItem title="A previously connected app stopped working">
    Check whether an Owner or Manager disabled the app for the organization. If it is still enabled, disconnect and reconnect the app to refresh its authorization.
  </TroubleshootingItem>
</Troubleshooting>

<RelatedLinks>
  <RelatedLink href='/harness/mcp' title='Model Context Protocol (MCP)'>
    Configure custom, private, and self-hosted tool servers.
  </RelatedLink>
  <RelatedLink href='/autonomy-and-safety/auto-run' title='Autonomy Level'>
    Control which connector actions run without confirmation.
  </RelatedLink>
  <RelatedLink href='/enterprise/hierarchical-settings-and-org-control' title='Enterprise Controls'>
    Understand organization settings, precedence, and governance.
  </RelatedLink>
  <RelatedLink href='/enterprise/identity-and-access' title='Identity & Access'>
    Manage Factory roles, membership, SSO, and Directory Sync.
  </RelatedLink>
</RelatedLinks>